Combining Information Security and Privacy Officer roles may seem efficient but often leads to oversight failures. This article explores their distinct responsibilities and explains why keeping them separate is crucial for effective risk management and compliance.
Policy Example SunSpot Credit Union Computer Incident Response Team—Access & Authorization Policy 1.0 Policy Statement This policy applies to SunSpot Credit Union employees, temporary workers, contractors, and consultants who use or access SunSpot Credit Union information systems and computers. 2.0 Purpose/Objectives Definitions for this policy are as follows: SunSpot Credit Union: (SCU). Incident Response Team:… Read More »
SunSpot Health Care Provider Remote Access Policy for Remote Workers & Medical Clinics 1.0 Policy Statement It is SunSpot Health Care Provider (SHCP) policy to protect Information Resources based on risk against accidental or unauthorized disclosure, modification, or destruction, and assure the Confidentiality, Integrity, and Availability (CIA) of clinic and patient data. Apply appropriate physical and… Read More »
Hand-Held Device use has become common place in today’s business environment to include company owned assets, and personal “Bring Your Own Device” (BYOD)’s. Security of Hand Held Devices normally spans over many of the other standard domains making it practical to treat them as a separate domain.. The SANS Reading Room article; Security Policy for the use of… Read More »
The following is a list of the primary benefits of the COBIT, ISO 27000, and NIST frameworks: COBIT COBIT allows much broader scope and takes into account all IT management processes. Geared towards a method of successfully executing key policies and procedures. It is often used to tie together controls, technical issues and risks, within an organization. COBIT… Read More »
The IT security policy framework is the foundation of an organizations information security program. The framework consists of a library of documents, but is just not a collection of documents. The framework and its documents are used to build an organizations processes, determine appropriate technologies to use, and lay the foundation for policy enforcement. The framework is a… Read More »
Bring Your Own Device (BYOD): Organizations allowing employees to use their own personal devices such as smart phone and tablets to conduct organization business. The SANS Reading Room article, SANS Survey on Mobility/BYOD Security Policies and Practices found that 61% of organizations allowed personal devices to connect to protected company systems, but only 9% of organizations were truly… Read More »
An Acceptable Use Policy (AUP) is an agreement between two or more parties, usually a business or service, and users of an information system. The AUP expresses in writing a policy of certain standards of behavior relating to the proper usage of specific hardware and software services. In other words, it is a set of rules created and… Read More »
When considering the implementation of security policies, an organization must also consider how employee behavior often varies depending on whether the organization uses a flat or hierarchical management structure. In flat organizations, there are less layers between management and employees so decisions and problem solving generally happens faster and at a lower level. Smaller organizations tend to be… Read More »
Ethical considerations play a vital role in the design of information systems, particularly in relation to the Confidentiality, Integrity, Availability (CIA) security concept. This article explores various ethical issues that must be addressed in information system design and their relevance to the CIA security triad. It delves into concerns such as the beneficiaries of collected information, privacy and confidentiality of user data, accuracy of information, property and ownership rights, accessibility controls, the purpose of information usage, system availability, and categorization for maintaining integrity. Understanding and addressing these ethical aspects is crucial for ensuring the responsible and secure handling of information within organizations.